v0.1.0

One command installs an agent plugin into every AI coding assistant on your machine — with a lockfile, secrets kept out of config files, and a scanner that reads what a plugin's instruction text tells your agent to do.

curl -fsSL https://raw.githubusercontent.com/agentbridgehq/agentbridge/main/install.sh | sh

The installer verifies a SHA-256 checksum against the signed checksum file below before writing anything, and the Sigstore signature too when cosign is present. AGENTBRIDGE_REQUIRE_SIGNATURE=1 makes cosign's absence an error.

What is in it

• Six clients. Claude Code, Cursor, VS Code / Copilot, Codex, Gemini CLI, opencode. Each gets the plugin in its own dialect — a directory here, JSON there, a TOML block somewhere else — and you are told exactly what each one took and what it dropped, with a reason.
• Skills reach Claude Code and opencode, the two clients whose vendors document where skill packages go. Elsewhere MCP servers install normally and the missing skills are reported rather than written to a guessed path.
• A scanner for instruction text. A SKILL.md is loaded into a model holding your credentials, your SSH agent and your source tree. No SCA tool, SAST scanner or EDR agent reads it. This one does — 15 rules over the text itself, plus hidden-text tricks: invisible characters, bidirectional overrides, look-alike alphabets. High-severity findings stop an install until you have looked.
• Pinned sources. Local directories, git references and OCI registries, each resolved to an immutable commit or digest before anything downloads, recorded in a lockfile you commit.
• Updates that show what changed. A version bump that grants an agent the network is a different event from one that does not, and one that adds an instruction to conceal activity is different again. New findings since the version you approved block an update; ones you already accepted do not ask twice.
• Secrets off disk. Tokens live in your OS keychain and are injected when the server launches, so they never sit in a file you could commit, back up or screen-share.
• Exact uninstall. Driven by a receipt of what was written, never by pattern-matching. Your own entries and comments survive — and so does your formatting: install then remove returns a config to its original bytes, which is enforced by a test.

Verifying this release

cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/agentbridgehq/agentbridge/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

gh attestation verify agentbridge_0.1.0_darwin_arm64.tar.gz --repo agentbridgehq/agentbridge

Every artifact also ships an SBOM. Only the checksum file is signed — verifying it transitively covers everything it lists.

Known gaps

Stated plainly, because a tool that argues about provenance should not overstate its own:

• brew and npm do not work yet. Homebrew and Scoop publishing stay disabled until those tap repositories exist; the npm name is not yet registered. install.sh is the supported path.
• Two clients have been independently measured, four have not. Codex reports an installed server as enabled, and opencode reports one as connected and lists the installed skills — their own tooling answering, not ours. Cursor and VS Code are desktop applications with no equivalent read-back, so what we write there matches their published schemas and is unconfirmed.
• Plugin signatures do not exist. These binaries are signed; a plugin's provenance is currently the commit or digest in your lockfile, which is real but is not a signature.

Nothing phones home. Every address the tool reaches is one you supplied — and that is enforced by a test, not promised. See docs/telemetry.md.

Start here: Getting started · Docs · CI integration